ITAR-Compliant Quoting for Machine Shops

Where ITAR Technical Data Leaks During Quoting

Quoting is the most exposed point in a defense shop's workflow because RFQs arrive by email, move between estimators, and go out to heat treaters, platers and NDT houses for outside-processing pricing. Each handoff is a possible export or unauthorized transfer if the recipient is a foreign person, including a foreign national employee, or sits on a cloud service with offshore administrators. Online instant-quote portals and generic file-share links are common culprits.

Another is the shared estimator inbox, where drawings sit in mailboxes accessible to staff who are not cleared for the program.

• Email attachments forwarded to outside processors without verifying their registration or US-person status
• Cloud quoting and CAD-sharing tools hosted outside US-only environments
• Offshore support or administrators with access to the mail or file server
• Estimator laptops that sync controlled folders to personal cloud accounts

A Quoting Workflow That Holds Up in an Audit

Start with intake: RFQs from primes land in a dedicated, access-controlled mailbox or portal, and a person screens each package for ITAR or EAR markings and export classification before it goes anywhere. Controlled packages are stored in a restricted folder or document library with named access. Estimators work from that location rather than copying files to desktops.

Outside-processing requests go only to vendors you have vetted for US-person handling, using a controlled transfer method. Log who opened what and when, so your Technology Control Plan has records, not just a policy. Keep the quote record in your ERP or quoting system, but store the drawing in the controlled repository and reference it by link.

Foreign Persons, Interns and Shared Offices

ITAR treats release of technical data to a foreign person inside the United States as an export. If your shop employs a green-card holder, that person is a US person, but a visa holder generally is not and would need a license or exemption to access the drawings. Many shops handle this through physical and logical separation: certain engineers and estimators are designated for controlled programs, and the rest are blocked at the file-permission level.

Interns, temp staff and visiting auditors need the same screening. Write the rule down in your Technology Control Plan, and keep a roster of who is authorized for which program, reviewed on a fixed schedule.

Speeding Up Quotes Without Weakening Controls

Compliance does not require slowness, but it does require that your speed tools stay inside the boundary. Pre-built cost libraries, similar-part search against past jobs in your ERP, standard processing price lists, and templated quote documents all run on internal data and cut hours per quote. AI can add to this when the model runs on your own hardware: it reads the package, extracts material, tolerances and special processes, finds comparable jobs, and drafts a cost buildup for the estimator to review.

Because the model never calls an outside API, the drawing never leaves your network. The estimator remains the approver and the one who signs off on pricing and clauses.

When This Is Overkill

If you quote few defense jobs, each large and unique, the overhead of a purpose-built controlled quoting environment may outweigh the benefit. A restricted SharePoint-style library with strict permissions, a trained two-person estimating team and a vetted vendor list can be enough. Likewise, if your drawings are not ITAR-controlled and carry only distribution statements or no marking, ordinary secure practices apply.

Confirm classification with your customer and, where in doubt, with export-compliance counsel, because mislabeling in either direction is costly. This article is operational guidance, not legal advice.